Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why aren't one-time sign in links more popular for authentication?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 198 posts

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#51

Post by ketamine__ »

krageon wrote: post #48
starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.

I've experienced that too.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#52

Post by squiggleblaz »

radu_floricica wrote: post #41

I'm assuming you intend those links to be single-use only and expire automatically, in which case what I'm writing below doesn't apply. Nevertheless, the problem is big enough to be worth repeating and re-repeating: Any link that ends up in a browser address bar should be treated as public. And no, it doesn't matter if you use HTTPS. Ways to leak it are many, but the gist is that it's treated as "meta-data" and, righ…

How do you advise we handle email address confirmation and password resets?

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#54

Post by jiofih »

jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#56

Post by hnlmorg »

GTP wrote: post #10

From a cryptographic perspective, when dealing with authentication the different methods fall in one of the different categories: 1) Something you know (e.g. a password) 2) Something you have (e.g. a token) 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...) Real OTPs fall in the second category, because you have some device/application that is able to generate the same O…

> 3) Something you are (usually biometric authrentication, like your fingerprint, a retina scan...)

I've always considered them to be more like user names, albeit with a larger entropy than your average user string.

Completely agree with your points though. Particularly with regards to OTP. I'd further expand on that and say hosting your TOTP codes in the same password management tool as your passwords themselves (as some tools are now offering) is also really bad idea.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#57

Post by jeswin »

starbugs wrote: post #11

We have tried this for a while and the following reasons made us kill it: 1. Email delivery latency: depending on the service you use, the time it takes to deliver emails to the user can vary. Worst case I encountered was up to 20 minutes delay when there were issues with Mailgun. 2. Usability: you have to leave your current app and switch to your mail client. You may be on a device where you don't have a mail client…

4. Gmail (atleast on Android) will try to open the link in a sort of Webview, which is never ideal. All the browser options are gone, plus I don't need to trust Gmail with the ability to read screen contents.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#58

Post by Macha »

jiofih wrote: post #54
jwr wrote: post #31

Oh, this is so terrible. I hate this approach with a passion. E-mail is NOT INSTANTANEOUS. It was never meant to be. It happens to arrive quickly for most people most of the time, but you should never, ever, base a service on that. Many systems have greylisting in place: a new sender gets a 4xx reply, and is allowed through only on subsequent retries after a pre-set time period. This is often as much as 30-60 minutes…

Email has been nearly instantaneous for me for the past decade or so. Either it arrives in a 30 second window, or never. Usually 2-5 seconds.

I have both a personal G Suite domain (formerly "Google Apps For Your Domain") and my employer's G Suite account where in both cases I've experienced 5+ minute delays on a semi-frequent basis.

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#59

Post by krageon »

ketamine__ wrote: post #51
krageon wrote: post #48

Earlier quoted context omitted.

From a user standpoint the delivery latency is really what kills it for me. I use one or two websites that still have one-time sign in links and it's always a tossup whether or not I can actually get in within a few minutes. If the email arrives an hour later I've moved on with my life and I can't imagine it is any different for other people.

I've experienced that too.

Then you haven't used it for very long. Besides that, more exists than some tech giant's gambit to gather and exploit as much user information as they can. Nobody should use gmail, unless they are forced to by their job (in which case they should try to change it if they are in a position to).

Re: Ask HN: Why aren't one-time sign in links more popular for authentication?

#60

Post by eeZah7Ux »

sneak wrote: post #53

Email is not a secure delivery mechanism. Everyone has an HSM in their pocket these days. The fact that we are having these discussions at all is ridiculous.

> HSM in their pocket

If you refer to the typical smartphone, it's an HSM without the Security, and also it's not truly Hardware.

Post reply on HN